quasar | 3ca09bc38ffb76baf1acdd6c2209358516e932c1ebf47a5f982c8ee8a18de6d2 | Triage™

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dG.exe
Size 3.1MB
Sample260620-e7c5naet8x
SHA256 3ca09bc38ffb76baf1acdd6c2209358516e932c1ebf47a5f982c8ee8a18de6d2
MD5 65456232d2d0f79eb80e24174b62cbc5
SHA1 356b575ac763498e633274d6253a4b379ddb419e
SHA512 14754db1c3a4ddfbcc88e1aaae838102a4fdc04e38637199f997c1f9457d09f597afcfe8cbcf90c918af53a826de8ef5bd3764260e6c3f6eee152c838e2c26e7
SSDEEP 49152:jvme821/aQWl8P0lSk3aKA3Z+nYAUmBmz3coGdHKTHHB72eh2NT:jvl821/aQWl8P0lSk3DA3Z+nNUmp
TLSH
T1A1E54A0577F85E62E1AAD3B3D5F0541363F0F82AF3A3EB0B5191677A1C93B4098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bugnet v3 execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

BuGnEt v3

C2

Bellosi-54747.portmap.host:4782
Bellosi-54747.portmap.host:54747

Mutex

fe0f145a-b7e8-41e8-b439-cfefd06b808c

Attributes

encryption_key
DA23FD565F976B13BBF844C91EF414F285F5D339
install_name
UnrealEngineLauncher.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
Logs
reconnect_delay
3000
startup_key
Epic Launcher
subdirectory
Epic Games

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/648-0-0x00000000005D0000-0x00000000008F4000-memory.dmp	family_quasar
behavioral1/files/0x0002000000022c45-5.dat	family_quasar

Executes dropped EXE 1 IoCs

pid	Process
3856	UnrealEngineLauncher.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Epic Games\UnrealEngineLauncher.exe	dG.exe
File opened for modification	C:\Program Files\Epic Games	dG.exe
File opened for modification	C:\Program Files\Epic Games\UnrealEngineLauncher.exe	UnrealEngineLauncher.exe
File opened for modification	C:\Program Files\Epic Games	UnrealEngineLauncher.exe
File created	C:\Program Files\Epic Games\UnrealEngineLauncher.exe	dG.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3972	schtasks.exe
2568	schtasks.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	648	dG.exe
Token: SeDebugPrivilege	3856	UnrealEngineLauncher.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3856	UnrealEngineLauncher.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3972	648	dG.exe	89
PID 648 wrote to memory of 3856	648	dG.exe	91
PID 3856 wrote to memory of 2568	3856	UnrealEngineLauncher.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\dG.exe
"C:\Users\Admin\AppData\Local\Temp\dG.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:648
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Epic Launcher" /sc ONLOGON /tr "C:\Program Files\Epic Games\UnrealEngineLauncher.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3972
- C:\Program Files\Epic Games\UnrealEngineLauncher.exe
  "C:\Program Files\Epic Games\UnrealEngineLauncher.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3856
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Epic Launcher" /sc ONLOGON /tr "C:\Program Files\Epic Games\UnrealEngineLauncher.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UnrealEngineLauncher.exe

Path C:\Program Files\Epic Games\UnrealEngineLauncher.exe
Size 3.1MB
SHA256 3ca09bc38ffb76baf1acdd6c2209358516e932c1ebf47a5f982c8ee8a18de6d2
MD5 65456232d2d0f79eb80e24174b62cbc5
SHA1 356b575ac763498e633274d6253a4b379ddb419e
SHA512 14754db1c3a4ddfbcc88e1aaae838102a4fdc04e38637199f997c1f9457d09f597afcfe8cbcf90c918af53a826de8ef5bd3764260e6c3f6eee152c838e2c26e7
SSDEEP 49152:jvme821/aQWl8P0lSk3aKA3Z+nYAUmBmz3coGdHKTHHB72eh2NT:jvl821/aQWl8P0lSk3DA3Z+nNUmp
TLSH
T1A1E54A0577F85E62E1AAD3B3D5F0541363F0F82AF3A3EB0B5191677A1C93B4098426A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/648-0-0x00000000005D0000-0x00000000008F4000-memory.dmp

Download

memory/648-1-0x0000000001080000-0x0000000001090000-memory.dmp

Download

memory/3856-8-0x000000001B360000-0x000000001B370000-memory.dmp

Download

memory/3856-9-0x000000001BB00000-0x000000001BB50000-memory.dmp

Download

memory/3856-10-0x000000001BC10000-0x000000001BCC2000-memory.dmp

Download

memory/3856-11-0x000000001B360000-0x000000001B370000-memory.dmp

Download